Security Review #254

We have reviewed potential security flaws in the MCP protocol, common attack vectors, and mitigation strategies. Additionally, this analysis covers the security features of Google's A2A protocol, offering insights for the industry to build more secure AI Agent products.

We implement an Iframe Sandwich exploit to escalate a simple isolated Cross Site Scripting attack, into the context of a more sensitive application.

This blog post explores the current state of browser mitigations that make CSWSH harder to exploit. These will be explored together with three case studies of past findings, investigating which of the attacks still work today.

Process Injection is one of the important techniques in the attackers' toolkit. Combining common building blocks in an atypical way, we created a much stealthier version of a known method, Thread Execution Hijacking.

We have uncovered a dangerous new supply chain attack vector we've named "Rules File Backdoor." This technique enables hackers to silently compromise AI-generated code by injecting hidden malicious instructions into seemingly innocent configuration files used by Cursor and GitHub Copilot.

This document details a methodology for detecting the IngressNightmare vulnerability chain affecting Kubernetes Ingress Nginx Controllers. We've developed a novel non-intrusive technique that leverages DNS callbacks through directive injection to reliably identify vulnerable instances without causing service disruption or requiring internal (agent-based) access.

Event Tracing for Windows (ETW) is a kernel mechanism designed to log certain activity happening in the system. Despite its seemingly innocuous description, ETW can be a valuable source of information and a very interesting hook point for both anti-cheats and other drivers.

We provide a technical analysis of StealC, one of the well-known stealers written in C++. We will investigate the loader, operations executed on the compromised host and how to decrypt C2 communication channel.

Volatility is a memory forensics tool that can pull SAM hashes from a vmem file. These hashes can be used to escalate from a local user or no user to a domain user leading to further compromise. The following example scenario will showcase the steps involved in this process.

Sigma is like your trusty Swiss Army knife for security analytics. It's powerful, versatile, and - when you know how to use it - it can save you hours of sifting through mountains of logs. In this blog, we’re diving into how you can work with Sigma to level up your security game.

In the second part of the series, I discuss about memory error detectors or sanitizer which are tools and methods to increase the likelihood of triggering a crash in the case of a bug or vulnerability and our approach to implementing a binary-only address sanitizer for macOS KEXT.

In this article, I'll guide you through the process of creating rules in ELK. This will help you to detect suspicious activities.

Cyberattackers that extract NTDS.DIT can exfiltrate password hashes and user details for Active Directory accounts. Learn how to protect AD.

This article explores the Linux Artifacts collected from Unix-like Artifacts Collector (UAC) tool. We will delve into the various types of artifacts, their significance in forensic analysis, and how they can be utilized to gain insights into system activity.

We've discovered and coordinated a quite interesting vulnerability affecting the Emarsys SDK for Android. Due to the lack of proper authorization checks, an attacker can call a particular activity and can forward himself web pages and/or deep links. On successful attack, an attacker could navigate to arbitrary URL including application deep links on the device.

We'll explore a very cool technique that intercepts the compilation process with LD_PRELOAD, modifying the commands executed and forcing the inclusion of a malicious library during linking. In the end, the compiled binary looks legitimate, but it is infected with embedded malicious code, ready to be executed at the right time.

XPC is an inter-process communication (IPC) mechanism used in macOS and iOS applications. In this article, I will explain how we can hook into an XPC server application, and perform actions on the UI application that will send XPC requests to the server. This allows us to observe the transmitted data and understand how it is sent.

This post aims to systematically explore the inner workings of the regf format, focusing on the hard requirements enforced by Windows. Hopefully, this deep dive clarifies some of the intricacies of the hive format and complements existing unofficial documentation.

In this article, we'll explore what the potential risks after a successful phishing attack when authentication tokens are captured. We'll examine how threat actors leverage these tokens to expand their access and the tools they use to exploit Microsoft 365 and Azure environments in particular.

Detecting ransomware in Amazon S3 and KMS is complex. Not all events are logged by default and available tools can miss events due to nuances in logging. This post covers 11 different indicators of different types of ransomware in AWS, how they show in logs, and if these are logged by default.

The Atomic macOS (AMOS) Stealer malware uses osascript to execute AppleScript to steal and exfiltrate data from mac systems. The TTPs outlined in this article provide multiple opportunities for identify MacOS threats (including Atomic Stealer) across the entire execution lifecycle.

This is a low-level technical dive into crafting, deploying, and operationalizing Custom YARA rules in a Blue Team environment. You'll be learning how to expertly reverse-engineer samples, pull valuable patterns, and create highly effective rules in order to identify real malware as well as in-the-wild anomalies in actual environments.

In this comprehensive guide, we share techniques – both simple and advanced – for exploiting vulnerabilities in HTTP headers, ranging from abusing custom headers to leveraging cache poisoning and reverse proxy misconfigurations.

This post will explore how we extracted AD credentials from SQL Server backup. We will look at how SQL Server encryption works, introduce some new methods of brute-forcing database encryption keys, and show a mistake in ManageEngine's ADSelfService product which allows compromised database backups to reveal privileged credentials.

The SuperNote A6 X2 Nomad is a 7.8 inch tablet running Android 11 under the hood. We detail how we were able to chain a vulnerability and a handful of misconfigurations into a remotely installable, 0-click rootkit (CVE-2025-32409). A malicious attacker on the same network as the victim could fully compromise the target device without any user-interaction.

Logs from different sources store timestamps in various formats, and some tools even output timestamps in local system time instead of UTC. One tool that presents this challenge is praudit, which reads BSM audit logs and outputs timestamps in the local system time.

This blog offers critical insights into identifying both pre-exploitation and post-exploitation artifacts of CVE-2025-24983, a zero-day vulnerability in the Windows Common Log File System (CLFS) that allows local privilege escalation to SYSTEM-level access. It aims at enabling defenders to detect malicious activity across different stages of the attack lifecycle and enhance threat-hunting efforts.

In this blog post, I will explain how RPC encryption works under the hood and how to implement it over the SSPI interface.

The goal of this post is to provide a thorough overview of the structures used in the Configuration Manager subsystem in Windows, with particular emphasis on the most important and frequently used ones, i.e. those describing hives and keys.

We detail how we can relay HTTP/SMB and LDAP NTLM authentications to WinRMS and thus gain remote code execution, once WinRMS is enabled when the HTTP endpoint is removed.

In this article, I'll walk you through the process of creating rules in ELK to detect RDP brute-force activities.

Sapphire tickets are the evolution of Diamonds Tickets, stealthier. These are legitimate tickets but while in Diamond, ticket modifies the PAC, the Sapphire ticket replaces it with the PAC of another privilege user. In this article, we are going to deep dive how sapphire ticket attacks work.

Learn about ELFDICOM, a Linux malware hidden in DICOM medical images. Learn how Praetorian's polyglot exploit threatens healthcare security via CVE-2019-11687.

Discover how AI vishing attacks are conducted using AI-generated voices, social engineering tactics, and explore defense strategies.

ReadGMSAPassword Attack is a technique where attackers abuse misconfigured Group Managed Service Accounts (gMSA) to retrieve their passwords. This guide will provide an in-depth explanation of ReadGMSAPassword, covering its working mechanism, the key attributes involved, and how attackers exploit it.

We uncover how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.

I will be exploring some options specifically how we can increase the telemetry regarding execution artefacts (like Windows Prefetch, Amcache, Shimcache the list goes on) on Linux using Sysmon for Linux and auditd.

In this blog post, we discuss different types of attacks targeting Exchange and SharePoint, and demonstrate how AMSI is helping organizations protect against these attacks. We also share mitigation and protection guidance, as well as detection details and hunting queries.

When performing process injection, one of the most important IOCs that make up behavioural signatures is passing execution to our shellcode. In this post I want to showcase not just a "new proof-of-concept technique", but the entire process I went through in hope that this can become a proper addition to a capability developer's skill set.

tstats pulls event data straight from already indexed fields instead of raw events, making it much faster for working with large datasets. Think of it as using stats in the first step of the analysis to speed up your counting, aggregating, and filtering of a data source.

I have found that the 'user agent' field in CloudTrail is a highly underrated indicator for malicious activity. Not only can it help identify potentially malicious activity, but it also provides valuable context around how an API was called - which can help differentiate between suspicious and benign behaviour.

In this blog, we'll break it down in the easiest way possible and give you all the tools, tips, and tricks you need to start hunting for threats in Windows Event Logs like a pro.

The Tycoon 2FA phishing kit has adopted several new evasion techniques aimed at slipping past endpoints and detection systems. These include using a custom CAPTCHA rendered via HTML5 canvas, invisible Unicode characters in obfuscated JavaScript, and anti-debugging scripts to thwart inspection. This blog takes a closer look at these methods.

This article delves into the cryptography mechanism of PDQ deploy and inventory. We investigate the credential storage, find the keys, analyzes the encryption flow and uncover a way to decrypt the application credentials.

While working on EDR MacOS bypass for DarwinOps, I made a few discoveries that might interest you. I was able to bypass the network security of two major EDRs (probably more) thanks to a trick evading network flow detection.

The following article describes how, during an "assumed breach" security audit, we compromised multiple web applications on our client's network in order to carry out a watering hole attack by installing fake Single Sign-On pages on the compromised servers.

In this post, we're continuing our deep dive into Dirty COW by exploring two of its known variants: Huge Dirty COW (CVE-2017-1000405) and SHM (Shared Memory) Dirty COW (CVE-2022-2590).

The Linux kernel has memory management (mm) related bugs over the years. One of the most well-known is the Dirty COW (CVE-2016-5195). In this post, I'll walk through the root cause of Dirty COW and share my thought process while digging into it.

In our second episode we take a look at SOPlanning, a project management application that we encountered during the audit. This article covers vulnerabilities we identified: SQL injection, authentication bypass, arbitrary file delete and upload and a race condition leading to remote code execution.

This is the story of how I figured out a way to turn my ThinkPad X1 Carbon 6th Gen laptop into a programmable USB device by enabling the xDCI controller. As a result, the laptop can now be used to emulate arbitrary USB devices such as keyboards or storage drives. Or to fuzz USB hosts with the help of Raw Gadget and syzkaller.

This article explores the notion of using EDR telemetry as a source of knowledge on software behaviors, and how to query that source to find potential security vulnerabilities.

ResolverRAT is a newly identified remote access trojan that combines advanced in-memory execution, API and resource resolution at runtime, and layered evasion techniques. This blog provides a technical deep dive into the infection chain, loader internals, evasion techniques, and C2 infrastructure.

Implementing robust security best practices is essential to fortify Kubernetes deployments and mitigate potential risks. In this article, we provide an overview of Kubernetes architecture and potential attack vectors and guidelines to properly secure your clusters.

Forcing Windows to leak NetNTLM hashes is not that difficult, many ways exists to do this. Some user interaction is often required, like enticing a victim to visit the attacker's website or open a specially crafted file. In this article, we review the main techniques used to leak and steal NTLM hashes.

We detail the URL file attack, that captures account hashes via a user accessing a folder that contains a specially crafted file, forcing the user to request an icon off the attackers machine. The resource does not exist though. The act of initiating a connection to the attackers machine is how the hash is captured.

The collection of NetNTLM hashes is not only highly effective, but also difficult to detect in large environments. In this article, we explore traditional and innovative techniques for harvesting NetNTLM hashes and investigate how to weaponize thos techniques.